1

I'm thinking about how the "port" operates for the network connections and tried reading the CCNA cert. guide to understand the details, however, I need to clarify doubts:

  1. does occupying all the TCP/UDP ports of a system/node with active connections indicating that no other upcoming network connection behavior can be established?

  2. regarding to the previous question, if so, can I consider this system/node safe from malicious(hacking) network connections that are knocking the door?

  3. can the services or applications within a system/node rob the ports that are currently in use? for example, the port 54321 is in use by a service but another program take control of it. Is there any standards to restrict such behavior?

  4. how does the port 80 operate for different browsers in the client that are connecting a same http webpage at the same time?does the web server still provide connections through port 80? or maybe I misunderstood something?

2

A port is a transport address for some transport protocols (TCP and UDP), much like addresses for network or data-link addresses. Also, understand that TCP and UDP use the same port number range, but they are not the same ports; TCP port 12345 is not UDP port 12345.

An application will request of TCP or UDP to get a connection with the transport protocol, and either get a random available port number, or a port number specifically requested by the application. Any data sent to that transport protocol at that port number will be sent to the application process that requested that association.

UDP is a connectionless protocol, and it will simply send or receive data for the associated application process with no guarantees of delivery. TCP, on the other hand, is a connection-oriented protocol, and it establishes connections, providing certain guarantees of in-order data delivery. An application process using a TCP port can establish multiple connections on the TCP port. This is explained in RFC 793, Transmission Control Protocol:

Multiplexing:

To allow for many processes within a single Host to use TCP communication facilities simultaneously, the TCP provides a set of addresses or ports within each host. Concatenated with the network and host addresses from the internet communication layer, this forms a socket. A pair of sockets uniquely identifies each connection. That is, a socket may be simultaneously used in multiple connections.

The binding of ports to processes is handled independently by each Host. However, it proves useful to attach frequently used processes (e.g., a "logger" or timesharing service) to fixed sockets which are made known to the public. These services can then be accessed through the known addresses. Establishing and learning the port addresses of other processes may involve more dynamic mechanisms.

Connections:

The reliability and flow control mechanisms described above require that TCPs initialize and maintain certain status information for each data stream. The combination of this information, including sockets, sequence numbers, and window sizes, is called a connection. Each connection is uniquely specified by a pair of sockets identifying its two sides.

When two processes wish to communicate, their TCP's must first establish a connection (initialize the status information on each side). When their communication is complete, the connection is terminated or closed to free the resources for other uses.

Since connections must be established between unreliable hosts and over the unreliable internet communication system, a handshake mechanism with clock-based sequence numbers is used to avoid erroneous initialization of connections.

This allows something like a web server on TCP port 80 to create multiple connections with multiple web browsers because each connection is uniquely identified by the source IP and TCP addresses.

  1. does occupying all the TCP/UDP ports of a system/node with active connections indicating that no other upcoming network connection behavior can be established?

No. UDP is connectionless, and TCP can have many connections on a single port.

  1. regarding to the previous question, if so, can I consider this system/node safe from malicious(hacking) network connections that are knocking the door?

No, not at all.

  1. can the services or applications within a system/node rob the ports that are currently in use? for example, the port 54321 is in use by a service but another program take control of it. Is there any standards to restrict such behavior?

No, a port assigned to an application process is unusable by any other process until the owning process releases it.

  1. how does the port 80 operate for different browsers in the client that are connecting a same http webpage at the same time?does the web server still provide connections through port 80? or maybe I misunderstood something?

That is explained above in the RFC. Each browser will have a random address and its own IP address so that the connection with that browswer is distinguished from other connections by other browsers.

| improve this answer | |
  • thanks for answering! another question just popped up in my head: since the tcp port 80 is registered for HTTP, is it possible to set port 80 for other services purposely? e.g. if i configure SFTP service to use port 80 purposely. – user53815 Oct 20 '19 at 16:09
  • If TCP port 80 has not been assigned to a process within a host, e.g. no HTTP server or other process that claimed it from TCP, then the first process claiming it can use it; it is only an address. This presents a problem where a remote host would need prior knowledge that your non-standard process was using port 80 if the remote host must connect to that process. That is the reason for the well-known ports. – Ron Maupin Oct 20 '19 at 16:12
  • okay, since the ports can have many connections on a single port, if I set a firewall rule and block the TCP port 80 on a web server then any clients will be impossible to access this web via port 80? If I just want to block some clients from accessing this web server then I should focus on these specific clients' IP instead of blocking the port 80 right? – user53815 Oct 22 '19 at 1:16
  • If you blanket block anything from sending to port 80, then nothing can get to port 80. Depending on the firewall, you could block inbound connections from specific IP addresses, but we would need a lot more information about the network to help with that, and it would properly be a new question. – Ron Maupin Oct 22 '19 at 1:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.